Microsoft 365 Litigation Holds

Discover supports the enabling or disabling of the Microsoft 365 litigation hold status for EWS mailbox, SharePoint, and OneDrive data targets. For SharePoint and OneDrive, the hold status is triggered by specifying a Microsoft Retention Policy to be assigned. These Retention Policies must be configured in the Microsoft 365 tenant by the customer.

To enable this feature, open the Discover settings (gear icon), select the Administrative tab, scroll down to the Legal Hold Settings section, and select the appropriate parameters. After specifying the hold settings, click the Save button to update your changes.

After the hold settings have been configured, holds may be triggered by selecting one or more data targets, hovering over the Action button, and selecting the option 'Enable Legal Hold on Server'.

Selecting this option marks the data target for legal hold. The process that triggers PowerShell requests to Microsoft 365 to set the litigation hold flag on the Microsoft 365 mailbox/archive or apply the retention tag that is specified for SharePoint or OneDrive sites runs automatically on a nightly basis. To trigger that process immediately, open the Administration area on the Discover dashboard, select Configuration then Legal Hold Targets. From this view select the targets to implement a hold for, hover over the green Action button, and select the 'Run Legal Hold Process'.

This view also provides a recap of any data targets previously placed on hold from Discover.

Notes

Note 1: Microsoft 365 may take up to four hours to update the litigation hold status for a data target.

Note 2: Customers who wish to apply legal holds to a mailbox must make sure that the mailbox is licensed for "Litigation Hold" in their Microsoft 365 console. Microsoft requires an Exchange Online plan 2 license (or E3/E4 or equivalent) to place a mailbox on litigation hold. Currently, Discover does not validate that the appropriate license level is applied to the mailbox.

Note 3: For Microsoft 365 email, Discover is currently applying the litigation hold flag in Exchange Online (as opposed to Microsoft Purview). This is also the flag that is checked to enable the yellow highlight on the data target grid indicating the hold is in effect.

PowerShell Informaiton

This section contains the PowerShell commands that are used for all three of the sources that support litigation hold. These commands may be found in their respective agent's Program Files folders. For example, the EWS Agent script for mailbox litigation holds may be found in:

C:\Program Files (x86)\Sherpa Software\Sherpa Connector\EWS Agent\PsScripts

EWS Agent PowerShell

Try {
<!--Include ConnectExchangeOnline.txt-->
$users = %MAILBOXOWNERS%
$users|Foreach-Object {
Set-Mailbox -identity $_ -LitigationHoldEnabled:%ISONHOLD% >>%RESULTSFILE%
}
Exit 0
} Catch {
Write-Output $_.Exception.Message >%RESULTSFILE%
Exit 1
}

SharePoint Agent PowerShell

Try {
<!--Include ConnectExchangeOnline.txt-->
$sites = %SITEURLS%
$sites|Foreach-Object {
<!--If ISONHOLD -->
Set-RetentionCompliancePolicy -Identity '%RPNAME%' -AddSharepointLocation $_ -ErrorAction Stop >>%RESULTSFILE%
<!--/If-->
<!--If ISNOTONHOLD -->
Set-RetentionCompliancePolicy -Identity '%RPNAME%' -RemoveSharepointLocation $_ -ErrorAction Stop >>%RESULTSFILE%
<!--/If-->
}
Exit 0
} Catch {
Write-Output $_.Exception.Message >%RESULTSFILE%
Exit 1
}

OneDrive Agent PowerShell

Try {
<!--Include ConnectExchangeOnline.txt-->
$sites = %SITEURLS%
$sites|Foreach-Object {
<!--If ISONHOLD -->
Set-RetentionCompliancePolicy -Identity '%RPNAME%' -AddOneDriveLocation $_ -ErrorAction Stop >>%RESULTSFILE%
<!--/If-->
<!--If ISNOTONHOLD -->
Set-RetentionCompliancePolicy -Identity '%RPNAME%' -RemoveOneDriveLocation $_ -ErrorAction Stop >>%RESULTSFILE%
<!--/If-->
}
Exit 0
} Catch {
Write-Output $_.Exception.Message >%RESULTSFILE%
Exit 1
}